T1122

T1122 is a designation used within the MITRE ATT&CK framework to label a specific technique or sub-technique used by cyber adversaries. The MITRE ATT&CK knowledge base is a widely adopted framework for describing adversary behavior, where techniques are assigned unique identifiers that begin with the letter T followed by four digits.

The mapping of T1122 to a particular technique can vary between versions of the ATT&CK framework. As the knowledge base is updated, the descriptions, examples, and related detections associated with T1122 may change. Because of this versioning, practitioners typically consult the current ATT&CK documentation to determine the exact definition, behavior, and context for T1122 in use at that time.

In practice, T1122 serves as a shorthand reference in security research, threat intelligence reports, and defensive tooling. Analysts and defenders use the code to discuss a specific adversary capability without recounting all of its details, facilitating clear communication and standardized comparison across reports and detections. Security products and threat intel feeds may map events, indicators, or rules to T1122 to support detection, alerting, and incident response workflows.

Limitations to note include the potential for differences in numbering across MITRE’s version updates and across different ATT&CK subdomains (for example, enterprise versus mobile). Readers are encouraged to verify the exact description and examples of T1122 in the current ATT&CK release relevant to their environment.

See also: MITRE ATT&CK, ATT&CK for Enterprise, threat intelligence methodologies.